World map

 

BM

World A4: Containers in the Cloud

ECR: your image shelf

You will learn: to keep Kedai Kancil's images in a private shelf inside AWS, and push to it safely.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Kedai Kancil’s image sits in a public freezer far away. Now the shop moves into the AWS mall. Where should the image live?

Watch

ECR: Elastic Container Registry: your private image shelf in the mall's storeroom. You pay for what you store. is that private shelf: a registry: The shop freezer where image packs are stored and shared, like Docker Hub., like in Docker World D5. Its image names are long addresses. Put the parts in order.

Left to right. Put these in order. Use the arrows, or drag.

  • .amazonaws.com
  • /kedai-kancil
  • 111122223333
  • :1.0
  • .dkr.ecr
  • .ap-southeast-5

Try it

Docker needs a login before it can push. The AWS CLI hands over a short-lived password. Build the safe login.

Tap the pieces in the right order.

…

Predict

That ECR password is a token. How long does it work?

Check

The CI role tries to push a new image. Read its key. Will AWS allow it?

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who
ci-deployer (role session)arn:aws:sts::111122223333:assumed-role/ci-deployer/run-42
Wants to
ecr:PutImage
On
arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai-kancil
Identity policy (key ring) · ecr-pull-only
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer"],
"Resource": "arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai-kancil"
}
]
}
Your guess:

Check

Good shelf habits, or risky? Swipe right for good.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Scan each image when it is pushed

You did it!

You can now keep images on a private ECR shelf, and push to it safely.

Go deeper (optional)

Making a shelf is one command. Here is the official example. Deleting one with --force deletes every image inside, so check the name twice.

bash
aws ecr create-repository --repository-name project-a/sample-repo
{
"repository": {
"registryId": "123456789012",
"repositoryName": "project-a/sample-repo",
"repositoryArn": "arn:aws:ecr:us-west-2:123456789012:repository/project-a/sample-repo"
}
}